ad740ca799781737a49356e8d66f648c9165f4aa05645334ff9f637eaf45dd59

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 01:30

Target

ad740ca799781737a49356e8d66f648c9165f4aa05645334ff9f637eaf45dd59.dll
Size

371KB
MD5

d91ed728154128e3b20ae7eab5c08660
SHA1

3f96f816dcd9792e023dc0f4e15cddc73d563b37
SHA256

ad740ca799781737a49356e8d66f648c9165f4aa05645334ff9f637eaf45dd59
SHA512

19e2400f826c9089439b867b87d99d36737b437d08c0827dedb15f820e4862f3d01440d66678a1a457ce643d7939594f1a35458fd736d8b9f11c0458df05d2e7
SSDEEP

6144:GjraOqemMbk1FtTkj7xgZW4Wms3uk3Ynv:GCOUMb2Fu+ZWisek

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1680	1304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad740ca799781737a49356e8d66f648c9165f4aa05645334ff9f637eaf45dd59.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad740ca799781737a49356e8d66f648c9165f4aa05645334ff9f637eaf45dd59.dll
  2⤵
  PID:1680

memory/1680-0-0x000000007A320000-0x000000007A386000-memory.dmp

Filesize
408KB

Download